Alternatives and similar repositories for mac-monitor

Users that are interested in mac-monitor are comparing it to the libraries listed below

• jamf / aftermath

  View on GitHub
  Aftermath is a free macOS IR framework
  ☆569Sep 25, 2025Updated 4 months ago
• infosecB / LOOBins

  View on GitHub
  Living Off the Orchard: macOS Binaries (LOOBins) is designed to provide detailed information on various built-in "living off the land" ma…
  ☆519Dec 19, 2025Updated last month
• themittenmac / TrueTree

  View on GitHub
  A command line tool for pstree-like output on macOS with additional pid capturing capabilities
  ☆276Aug 23, 2024Updated last year
• objective-see / ProcessMonitor

  View on GitHub
  Process Monitor Library (based on Apple's new Endpoint Security Framework)
  ☆491Oct 20, 2023Updated 2 years ago
• SuprHackerSteve / Crescendo

  View on GitHub
  Crescendo is a swift based, real time event viewer for macOS. It utilizes Apple's Endpoint Security Framework.
  ☆1,071Jul 22, 2021Updated 4 years ago
• WithSecureLabs / ESFang

  View on GitHub
  ESF modular ingestion tool for development and research.
  ☆37Dec 21, 2021Updated 4 years ago
• 0xmachos / macOS-Security-Research

  View on GitHub
  macOS Security Research
  ☆122Mar 15, 2024Updated last year
• r3ggi / electroniz3r

  View on GitHub
  Take over macOS Electron apps' TCC permissions
  ☆220Aug 12, 2023Updated 2 years ago
• usnistgov / macos_security

  View on GitHub
  macOS Security Compliance Project
  ☆2,240Feb 3, 2026Updated 2 weeks ago
• theevilbit / Shield

  View on GitHub
  An app to protect against process injection and suspicious file links on macOS
  ☆230May 19, 2021Updated 4 years ago
• its-a-feature / LockSmith

  View on GitHub
  ObjectiveC CLI tool for interacting with macOS Keychain
  ☆82Oct 10, 2022Updated 3 years ago
• PhorionTech / Kronos

  View on GitHub
  Phorion Kronos is a macOS security tool designed to enhance Apple's Transparency Consent and Control (TCC) security and privacy mechanism…
  ☆79Nov 21, 2023Updated 2 years ago
• mandiant / macos-UnifiedLogs

  View on GitHub
  A cross platform parser for Apple UnifiedLogs!
  ☆323Feb 1, 2026Updated 2 weeks ago
• tsale / EDR-Telemetry

  View on GitHub
  This project aims to compare and evaluate the telemetry of various EDR products.
  ☆1,924Jan 20, 2026Updated 3 weeks ago
• google / santa

  View on GitHub
  A binary authorization and monitoring system for macOS
  ☆4,513Feb 5, 2025Updated last year
• ydkhatri / mac_apt

  View on GitHub
  macOS (& ios) Artifact Parsing Tool
  ☆991Feb 11, 2026Updated last week
• breakpointHQ / TCC-ClickJacking

  View on GitHub
  A proof of concept for a clickjacking attack on macOS.
  ☆97Feb 12, 2024Updated 2 years ago
• vastlimits / esmat

  View on GitHub
  macOS Endpoint Security Message Analysis Tool
  ☆47Jan 31, 2022Updated 4 years ago
• objective-see / Malware

  View on GitHub
  macOS Malware Collection
  ☆630Jan 19, 2026Updated 3 weeks ago
• its-a-feature / offensive_macos

  View on GitHub
  Tracking of offensive macOS tooling, blogs, and related helpful information
  ☆192Nov 18, 2024Updated last year
• objective-see / DNSMonitor

  View on GitHub
  A DNS Monitor, leveraging Apple's NEDNSProxyProvider/Network Extension Framework
  ☆210Aug 20, 2024Updated last year
• trailofbits / sinter

  View on GitHub
  A user-mode application authorization system for MacOS written in Swift
  ☆301Sep 18, 2020Updated 5 years ago
• D00MFist / Mystikal

  View on GitHub
  macOS Initial Access Payload Generator
  ☆323Jan 10, 2024Updated 2 years ago
• D00MFist / PersistentJXA

  View on GitHub
  Collection of macOS persistence methods and miscellaneous tools in JXA
  ☆286Aug 3, 2023Updated 2 years ago
• ReversecLabs / Jamf-Attack-Toolkit

  View on GitHub
  Suite of tools to facilitate attacks against the Jamf macOS management platform.
  ☆189Feb 10, 2021Updated 5 years ago
• cedowens / SwiftBelt

  View on GitHub
  A macOS enumeration tool inspired by harmjoy's Windows-based Seatbelt enumeration tool. Author: Cedric Owens
  ☆340Apr 28, 2022Updated 3 years ago
• blacktop / ipsw

  View on GitHub
  iOS/macOS Research Swiss Army Knife
  ☆3,134Updated this week
• xorrior / macOSTools

  View on GitHub
  macOS Offensive Tools
  ☆271Sep 28, 2023Updated 2 years ago
• objective-see / DumpBTM

  View on GitHub
  And open-source version of % sfltool dumpbtm
  ☆146Oct 18, 2023Updated 2 years ago
• CrowdStrike / automactc

  View on GitHub
  AutoMacTC: Automated Mac Forensic Triage Collector
  ☆553Mar 31, 2022Updated 3 years ago
• ninxsoft / LowProfile

  View on GitHub
  A Mac utility to help inspect Apple Configuration Profile payloads.
  ☆412Oct 11, 2025Updated 4 months ago
• slyd0g / SwiftLiverpool

  View on GitHub
  Enumerate Location Services using CoreLocation API on macOS
  ☆18Dec 2, 2021Updated 4 years ago
• richiercyrus / Venator-Swift

  View on GitHub
  Swift Command line tool used for proactive detection of malicious activity on macOS systems.
  ☆67Jul 1, 2020Updated 5 years ago
• elastic / protections-artifacts

  View on GitHub
  Elastic Security detection content for Endpoint
  ☆1,376Updated this week
• Yamato-Security / hayabusa

  View on GitHub
  Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
  ☆3,020Updated this week
• its-a-feature / Orchard

  View on GitHub
  JavaScript for Automation (JXA) tool to do Active Directory enumeration.
  ☆106Feb 19, 2022Updated 3 years ago
• cedowens / EntitlementCheck

  View on GitHub
  Scripts (python3 and Swift) for macOS to recursively check /Applications and also check /usr/local/bin, /usr/bin, and /usr/sbin for binar…
  ☆98Sep 14, 2022Updated 3 years ago
• its-a-feature / Mythic

  View on GitHub
  A collaborative, multi-platform, red teaming framework
  ☆4,296Feb 10, 2026Updated last week
• FalconForceTeam / FalconHound

  View on GitHub
  FalconHound is a blue team multi-tool. It allows you to utilize and enhance the power of BloodHound in a more automated fashion. It is de…
  ☆817Feb 17, 2025Updated last year